CVE-2026-68498: CWE-400 Uncontrolled Resource Consumption in FasterXML jackson-core

The vulnerability arises because the StreamReadConstraints.maxNameLength limit (default 50,000 characters) intended to restrict JSON property name length is not enforced early enough when parsing character-based JSON inputs. The ReaderBasedJsonParser accumulates property names into a buffer that only validates against the much larger maxStringLength (default 100,000,000 characters) during segment filling. The correct maxNameLength check occurs only after the entire name is buffered, allowing attackers to force large memory allocations before an exception is thrown. This can be exploited remotely by sending JSON with a single very long property name, causing heap exhaustion and process crashes. Byte-input parsers such as UTF8StreamJsonParser are not affected due to proper incremental validation. The vulnerability affects jackson-core versions >=2.16.0 but before fixed versions in the ranges <2.18.10, <2.21.6, <2.22.2, <3.1.6, and <3.2.2.

An unauthenticated remote attacker can cause a denial of service by forcing the jackson-core parser to allocate excessive memory (approximately 200 MB per request) when parsing a single JSON property name from character-based inputs. This can lead to heap exhaustion and crash the application process. The vulnerability does not affect confidentiality or integrity but impacts availability. It is exploitable under default configurations because maxDocumentLength is disabled by default, allowing very large tokens to be processed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is applied, avoid parsing untrusted JSON from character-based sources such as String, Reader, or char[] inputs. Prefer parsing from raw UTF-8 byte streams, which are not affected. Consider configuring StreamReadConstraints to enforce stricter limits if possible. Monitor vendor communications for official fixes and update jackson-core to fixed versions once available.